I have been experimenting with privilege escalation using the mount command and would like to know if it is possible to create a suid file owned by root without having access to any external device. i.e. I'm trying to find a way to do one the following:
bind mount /bin/bash to another file, so that I can set the suid bit on it (and have it stay after unmount somehow). Or bind mount a suid user copy of /bin/bash to a file owned by root.
mount a squashfs, .iso, or other existing filesystem with files normally owned by root in it (example: filesystem.squashfs from an ubuntu .iso image), so that I can set the suid bit on them.
The setup is as follows:
- sudo mount with any arguments is allowed
- no possibility to get a root suid file onto the computer from another device
I know I can easily gain root by bind mounting /etc/group, /etc/sudoers, etc, but would like to know if other ways are possible, in particular any way to create a root suid file without having access to any external machine (or virtual machine).